Issues

• IIS: IPv6 link-local client addresses break IP matching ("IPmatch: bad IPv6 specification")

  2.xPlatform - IIS
  owasp-modsecurity/ModSecurity#3630 · Filter by author A13501350 opened on Sep 17, 2026

• IIS: ReadFileChunk allocates only 1 byte but reads m_dwPageSize (latent overflow)

  2.xPlatform - IIS
  owasp-modsecurity/ModSecurity#3623 · Filter by author A13501350 opened on Aug 27, 2026
  1

• IIS: Host header fallback is dead code (r->hostname == NULL can never be true)

  2.xPlatform - IIS
  owasp-modsecurity/ModSecurity#3621 · Filter by author A13501350 opened on Aug 27, 2026
  1

• IIS: Content-Length header corrupted/truncated for large responses (wrong printf format + off-by-one buffer size)

  2.xPlatform - IIS
  owasp-modsecurity/ModSecurity#3619 · Filter by author A13501350 opened on Aug 27, 2026
  1

• IIS connector: audit log F part always shows '500 Internal Server Error' for normal traffic

  2.xPlatform - IIS
  owasp-modsecurity/ModSecurity#3612 · Filter by author A13501350 opened on Aug 14, 2026
  1

• multipart C-T header validation - false positive (rule id 200002, Multiple boundary parameters)

  3.xbug
  owasp-modsecurity/ModSecurity#3610 · Filter by author zyro23 opened on Aug 13, 2026
  3

• libModSecurity3: REQUEST_HEADERS names are treated as case sensitive with configure-time rule-exclusions

  3.x🥇 good first issue
  owasp-modsecurity/ModSecurity#3609 · Filter by author EsadCetiner opened on Aug 7, 2026
  2

• Windows build fails: yajl's Conan recipe sets CMP0026 OLD, incompatible with newer CMake

  3.xwindows
  owasp-modsecurity/ModSecurity#3604 · Filter by author fzipi opened on Jul 28, 2026
  2

• Partial Log Forging in RuleMessage::log() via Unescaped Quote Characters in Request-Derived Fields

  3.x
  owasp-modsecurity/ModSecurity#3601 · Filter by author amitu314 opened on Jul 20, 2026
  3

• x86 IIS module in CI-built MSI fails to load - fuzzy.dll missing MinGW runtime DLLs (error 126)

  2.x
  owasp-modsecurity/ModSecurity#3599 · Filter by author webwizuk opened on Jul 17, 2026
  1

• GnuTLS after many apache reloads

  2.x
  owasp-modsecurity/ModSecurity#3590 · Filter by author Nachtlichtermeer opened on Jun 29, 2026
  9

• @ipMatchFromFile and @ipMatch code (same code in v2 & v3) becomes buggy from a certain number of IP.

  3.x
  owasp-modsecurity/ModSecurity#3588 · Filter by author JIFVGWHvAseSovQ opened on Jun 28, 2026
  3

• ModSecurity POST: SQLi bypass via request-body predicate/operator rewrites

  3.x
  owasp-modsecurity/ModSecurity#3587 · Filter by author WAFSignal opened on Jun 27, 2026
  1

• ModSecurity GET(JSON): SQLi bypass via separator, literal, and annotation variants

  owasp-modsecurity/ModSecurity#3586 · Filter by author WAFSignal opened on Jun 27, 2026
  1

• Fix Failing to Match IPv6 Addresses@ipMatchFromFile

  3.x
  owasp-modsecurity/ModSecurity#3584 · Filter by author JIFVGWHvAseSovQ opened on Jun 27, 2026
  8

• Apache-Error: [file "apache2_util.c"] [line 275] [level 3] ModSecurity: JSON parsing error: lexical error: invalid char in json text.

  2.x
  owasp-modsecurity/ModSecurity#3581 · Filter by author RougeB opened on Jun 19, 2026
  3

• SecUploadFileMode parsed as decimal instead of octal; temp files have no read permission

  3.x
  owasp-modsecurity/ModSecurity#3580 · Filter by author LeShaunJ opened on Jun 17, 2026
  1

• wiki: Remove deprecated REQBODY_PROCESSOR_ERROR and REQBODY_PROCESSOR_ERROR_MSG from wiki pages

  2.x
  owasp-modsecurity/ModSecurity#3576 · Filter by author hnakamur opened on Jun 16, 2026
  9

• Ubuntu nginx 1.24.0-2ubuntu7.10 crashes workers with ngx_http_modsecurity_module enabled; 1.24.0-2ubuntu7.9 works

  3.x
  owasp-modsecurity/ModSecurity#3572 · Filter by author DennisYildirim opened on Jun 9, 2026
  3

• Audit log match does not represent chained rules

  3.xduplicate
  owasp-modsecurity/ModSecurity#3569 · Filter by author meirdev opened on May 19, 2026
  1

• REQBODY_ERROR "Extra content at the end of the document" after 3.0.15 update

  3.x
  owasp-modsecurity/ModSecurity#3563 · Filter by author ssigwart opened on May 13, 2026
  11

• Hit rule and record request_body log.

  3.x
  owasp-modsecurity/ModSecurity#3561 · Filter by author opsmeta opened on May 11, 2026
  3

• Exclude .gitignore files from release tarballs

  3.x
  owasp-modsecurity/ModSecurity#3559 · Filter by author twouters opened on May 8, 2026
  6

• Log message should indicate if operator is negative

  owasp-modsecurity/ModSecurity#3554 · Filter by author meirdev opened on May 2, 2026
  1

• Remove code specific to Internet Explorer

  2.x3.x
  owasp-modsecurity/ModSecurity#3549 · Filter by author theseion opened on Apr 20, 2026
  2